nuovo greyware?

[hijack88]

ciao a tutti, prima di postare il topic ne ho letto altri , e tentato le possibili soluzioni, senza però riuscire ad eliminare il problema: esso consiste in un una pagina che si sostituisce alla pagina predefinita di IE .si tratta di una pagina di registrazione a servizi di che non ho mai richiesto.tentativi provati:
1- bloccato la url da avast, ma doipo un po non mi ha fatto funzionare neanche più l'aggiornamento di esso , bloccandolo
2 - ho scannerizzato con bitdefender che mi ha rilevato un greyware e un malware, che ho eliminato online. riavviato il pc .niente la pagina
3 - scannerizzato e fixato tutto con cwshredder in modalità provvisoria e scannerizzato con hijackthis eliminando i file un po sospetti. dapprima ho visto che si apriva google ma provando digitare qualcosa e a premere invio mi dava sempre la pagina .
ora per fortuna sto usando un cell motorola con connessione della 3 però mi succhia i soldi.
ovviamente ho il log di hijackthis . grazie



Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 19.12.03, on 20/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\mobile PhoneTools\mPhonetools.exe
C:\Documents and Settings\Renato\Desktop\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Apri in nuova scheda in primo piano - res://C:\Programmi\Windows Live Toolbar\Components\it-it\msntabres.dll.mui/230?e8cb973c87604fd1abe4be148ee1eaa5
O8 - Extra context menu item: Apri in nuova scheda in secondo piano - res://C:\Programmi\Windows Live Toolbar\Components\it-it\msntabres.dll.mui/229?e8cb973c87604fd1abe4be148ee1eaa5
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan ... stubie.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resourc ... oscan8.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/ ... leId=19588
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan ... asinst.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15034/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{58CD9E9F-DAD5-48C0-B40E-40BE05A27EE5}: NameServer = 62.13.171.2 62.13.171.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs:
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SrvPjp - Unknown owner - C:\Programmi\File comuni\Services\XnK.exe (file missing)
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

--
End of file - 7180 bytes

[hijack88]

ciao Luke57 ho trovato i consigli che ho seguito passo per passo viewtopic.php?t=72742 ma ora sembra che con la connessione ethernet e router/modem non apra più le pagine, quindi qualcosa è stato eliminato ma non vorrei averlo fatto troppo ! vi posto il log di rapporto di combofix:
ComboFix 08-05-20.1 - Renato 2008-05-20 23.21.38.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.708 [GMT 2:00]
Eseguito da: C:\Documents and Settings\Renato\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Creati Da 2008-04-20 al 2008-05-20 )))))))))))))))))))))))))))))))))))
.

2008-05-20 23:20 . 2008-05-20 23:20 <DIR> d-------- C:\Programmi\StopDialers
2008-05-20 13:42 . 2008-05-20 16:00 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2008-05-20 13:35 . 2008-05-20 13:35 <DIR> d-------- C:\Programmi\Panda Security
2008-05-20 12:17 . 2008-05-20 12:11 691,545 --a------ C:\WINDOWS\unins000.exe
2008-05-20 12:17 . 2008-05-20 12:17 2,542 --a------ C:\WINDOWS\unins000.dat
2008-05-20 12:06 . 2008-05-20 12:06 <DIR> d-------- C:\Programmi\Spybot - Search & Destroy
2008-05-20 12:06 . 2008-05-20 12:11 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2008-05-19 22:42 . 2008-05-20 16:46 <DIR> d-------- C:\Documents and Settings\Renato\.housecall6.6
2008-05-10 13:16 . 2008-05-19 16:13 <DIR> d-------- C:\Programmi\iTunes
2008-05-10 13:16 . 2008-05-10 13:16 <DIR> d-------- C:\Programmi\iPod
2008-05-09 17:30 . 2008-05-09 17:30 <DIR> d-------- C:\Programmi\nobrand
2008-05-08 11:02 . 2008-05-08 11:04 <DIR> d-------- C:\Programmi\mobile PhoneTools
2008-04-30 21:36 . 2008-04-30 21:36 <DIR> d-------- C:\WINDOWS\Sun
2008-04-30 21:35 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-04-30 21:34 . 2008-04-30 21:35 <DIR> d-------- C:\Programmi\Java
2008-04-30 21:31 . 2008-04-30 21:31 <DIR> d-------- C:\Programmi\File comuni\Java

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-20 17:00 --------- d-----w C:\Documents and Settings\Renato\Dati applicazioni\Skype
2008-05-20 14:49 2,864 ----a-w C:\WINDOWS\system32\winsock.dll
2008-05-19 14:10 --------- d-----w C:\Programmi\Astonsoft
2008-05-08 11:42 --------- d--h--w C:\Programmi\InstallShield Installation Information
2008-05-08 09:07 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\BVRP Software
2008-05-08 09:04 --------- d-----w C:\Programmi\LiveUpdate
2008-05-03 15:50 63,984 ----a-w C:\Documents and Settings\Renato\Dati applicazioni\GDIPFONTCACHEV1.DAT
2008-04-28 08:32 --------- d-----w C:\Programmi\File comuni\Adobe
2008-04-26 16:22 --------- d-----w C:\Programmi\File comuni\Motorola Shared
2008-04-26 16:19 --------- d-----w C:\Programmi\Bonjour
2008-04-16 20:36 --------- d-----w C:\Programmi\VstPlugins
2008-04-15 18:13 --------- d-----w C:\Documents and Settings\Renato\Dati applicazioni\Steinberg
2008-04-15 17:26 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Pinnacle
2008-04-03 21:55 --------- d-----w C:\Programmi\DivX
2008-04-03 21:52 --------- d-----w C:\Programmi\Google
2008-04-03 21:38 --------- d-----w C:\Documents and Settings\Renato\Dati applicazioni\Apple Computer
2008-03-26 20:38 327,456 ----a-w C:\WINDOWS\A8VXE702.zip
2008-03-26 20:33 324,893 ----a-w C:\WINDOWS\0501.zip
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 183,072 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:06 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-02-24 23:48 45,056 ----a-w C:\WINDOWS\SIUnInst.exe
2008-02-21 02:05 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-02-21 02:05 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-02-21 02:05 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-02-21 02:05 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2008-02-21 02:05 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
2008-02-21 02:05 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2008-02-21 02:05 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-02-21 02:04 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-02-21 02:04 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-02-21 02:04 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-02-21 02:04 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-02-21 02:04 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-02-21 02:04 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-02-21 02:04 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-02-21 02:04 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-02-21 02:04 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-02-21 02:04 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-02-21 02:04 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-02-21 02:04 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-02-21 02:03 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-02-21 02:03 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-02-20 06:50 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:33 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-11 15:43 1,024 ----a-w C:\Documents and Settings\All Users\Dati applicazioni\1doc2pdf.dll
2007-09-04 15:34 92,064 ----a-w C:\Documents and Settings\Renato\mqdmmdm.sys
2007-09-04 15:34 9,232 ----a-w C:\Documents and Settings\Renato\mqdmmdfl.sys
2007-09-04 15:34 79,328 ----a-w C:\Documents and Settings\Renato\mqdmserd.sys
2007-09-04 15:34 66,656 ----a-w C:\Documents and Settings\Renato\mqdmbus.sys
2007-09-04 15:34 6,208 ----a-w C:\Documents and Settings\Renato\mqdmcmnt.sys
2007-09-04 15:34 5,936 ----a-w C:\Documents and Settings\Renato\mqdmwhnt.sys
2007-09-04 15:34 4,048 ----a-w C:\Documents and Settings\Renato\mqdmcr.sys
2007-09-04 15:34 25,600 ----a-w C:\Documents and Settings\Renato\usbsermptxp.sys
2007-09-04 15:34 22,768 ----a-w C:\Documents and Settings\Renato\usbsermpt.sys
.

((((((((((((((((((((((((((((( snapshot@2008-05-20_23.12.57,85 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-20 17:37:31 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-20 21:17:42 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 1996-01-11 22:00:00 722,192 ----a-w C:\WINDOWS\system32\vb40032.dll
+ 2008-05-20 21:17:47 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_640.dat
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 19:27 15360]
"MSMSGS"="C:\Programmi\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
"SpybotSD TeaTimer"="C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46 1460560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19 79224]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 17:22 7618560]
"Adobe Reader Speed Launcher"="C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"iTunesHelper"="C:\Programmi\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 19:27 15360]

C:\Documents and Settings\Renato\Menu Avvio\Programmi\Esecuzione automatica\
Stop Dialers.lnk - C:\Programmi\StopDialers\StopDialers.exe [2004-03-25 19:55:06 273408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.asv2"= asusasv2.dll
"Midi1"= ma_cmidn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programmi\\Messenger\\msmsgs.exe"=
"C:\\Programmi\\Alwil Software\\Avast4\\ashAvast.exe"=
"D:\\eMule\\emule.exe"=
"C:\\Programmi\\Skype\\Phone\\Skype.exe"=
"C:\\Documents and Settings\\Renato\\Desktop\\Skype.exe"=
"C:\\Programmi\\MSN Messenger\\msnmsgr.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
S2 SrvPjp;SrvPjp;"C:\Programmi\File comuni\Services\XnK.exe" []
S3 EVOLUSB;%EVOL_USB_SvcDesc%;C:\WINDOWS\system32\drivers\evolusb.sys []
S3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2005-03-18 10:39]
S3 MA_CMIDI;M-Audio USB Driver;C:\WINDOWS\system32\drivers\ma_cmidi.sys []
S3 PAC207;Trust WB-1400T Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys []
S3 pwalker;Process Walker Driver;C:\DOCUME~1\Renato\IMPOST~1\Temp\nsn5.tmp\pwalker.sys []
S3 SynasUSB;SynasUSB;C:\WINDOWS\system32\drivers\SynasUSB.sys [2006-01-29 13:48]
S3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys []

.
Contenuto della cartella 'Scheduled Tasks'
"2008-05-20 10:01:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Programmi\Apple Software Update\SoftwareUpdate.exe
"2007-09-30 07:47:36 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Programmi\Windows Live Toolbar\MSNTBUP.EXE
"2007-09-13 23:00:00 C:\WINDOWS\Tasks\eMule.job"
- D:\eMule\emule.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-20 23:22:35
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
Ora fine scansione: 2008-05-20 23.23.03
ComboFix-quarantined-files.txt 2008-05-20 21:22:56
ComboFix2.txt 2008-05-20 21:13:07

8 Directory 29,818,314,752 byte disponibili
11 Directory 29,805,223,936 byte disponibili

160 --- E O F --- 2008-05-16 13:24:07

[Luke57]

Ciao, Scarica ATF-Cleaner sul desktop(lo userai dopo) o deve ti rimane più comodo
http://www.atribune.org/ccount/click.php?id=1

Scarica questi 2 removal tool sul desktop
1°
http://www.prevx.com/gromozon.asp (Clicca sul bottone verde "Download gromozon removal tool")
2°
http://securityresponse.symantec.com/av ... inkopt.exe

Esegui il primo tool, ti chiederà di riavviare, tu riavvia, una volta riavviato il pc partirà la scansione, attendi la fine della scansione e riavvia il pc in modalità provvisoria, una volta dentro esegui il secondo removal tool, attendi la fine della scansione, finita la scansione,
Avvia ATF-Cleaner
Esegui il programma(non necessita di installazione)
Spunta le voci sotto elencate, in grassetto, presenti nel tag "Main"
Windows Temp
Current User Temp
Cookies
Temporary Internet Files
Java Cache
Clicca sul pulsante [b]Empy Selected

Se hai firefox vedrai il tag "Firefox" in grassetto e selezioni le voci
Firefox cache
Firefox cookies
Clicca sul pulsante Empy Selected

Se hai opera vedrai il tag "Opera" in grassetto e selezioni le voci
Opera cache
Opera cookies
Clicca sul pulsante Empy Selected

Riavvia il pc normalmente
Posta questi 2 logs:
1-C:\gromozon_removal.txt
2-FixLinkopt.log

[hijack88]

grazie tante e scusa per il ritardo della risposta , purtroppo non riesco a scaricare i tool dal mio pc, ormai infetto quindi ho cercato un pc da cui scaricare i programmi da te postati, dopodichè li trasferisco con pendrive sul mio pc seguendo le tue istruzioni. intanto incrocio le dita. a dopo

[hijack88]

ciao Luke, ho eseguito i tools e il secondo in modalità provvisoria era un poco lento, e all'inizio del primo non mi dava nessun file di log (ho cercato dappertutto) ora rifaccio tutto da capo.

[Luke57]

Ciao, se i tools non rilevassero niente, Scarica sul desktop systemscan
http://www.suspectfile.com/systemscan
aprilo ed assicurati che tutte le opzioni siano spuntate, clicca su "Scan Now" al termine della scansione verranno rilasciati (sempre sul desktop all'interno della cartella suspectfile) due file. Allega il file con estensione .zip nella tua prossima risposta.

Ricordati d'effettuare la scansione senza connessione attiva e con l'antivirus disabilitato salvo poi riattivarlo a scansione terminata.

[hijack88]

avevi ragione nel post precedente grazie. allego log di suspectfile

[hijack88]

ciao Luke,non so quanto possa essere rilevante però mi sono ricordato di avere usato regcleaner ed avere eliminato alcune voci di registro, di preciso quelle con scritta N/D che, a detta del programma si possono eliminare..spero di non avere fatto danni!ho notato che da quando c'è la pagina/mostro gli aggiornamenti sono bloccati totalmente: avast, l'archivio virus dello stesso, ipod, eccetera

[hijack88]

circa una settimana fa.

[Luke57]

Ciao, scarica avenger sul desktop
http://swandog46.geekstogo.com/avenger.zip
Decomprimi l'archivio
Avvia il file avenger.exe
All'interno del box bianco,copia e incolla le scritte seguenti:

folders to delete:
C:\Documents and Settings\Renato\Impostazioni locali\Temp
C:\documents and settings\ZyMrjJrXFlXVxrrlU
C:\documents and settings\ZyMrjJrXFlXVxrrlU.A3500
C:\Windows\temp

registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\SrvPjp

registry values to delete:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList | ZyMrjJrXFlXVxrrlU

Premi il tasto Execute.
Il computer dovrebbe riavviarsi, se non lo facesse, riavvialo tu.
Posta il report che troverai in C:\avenger.txt.

Poi da start>esegui>digita control userpasswords2 >OK
nella finestra verifica che fra gli account non vi sia
ZyMrjJrXFlXVxrrlU
altrienti evidenzialo e rimuovilo

[hijack88]

ecco fatto ho anche cancellato ZyMrjJrXFlXVxrrlU dalla password in esegui.
ho provato a connettermi ma la pagina c'è ancora!
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Folder "C:\Documents and Settings\Renato\Impostazioni locali\Temp" deleted successfully.

Error: folder "C:\documents and settings\ZyMrjJrXFlXVxrrlU" not found!
Deletion of folder "C:\documents and settings\ZyMrjJrXFlXVxrrlU" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: folder "C:\documents and settings\ZyMrjJrXFlXVxrrlU.A3500" not found!
Deletion of folder "C:\documents and settings\ZyMrjJrXFlXVxrrlU.A3500" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Folder "C:\Windows\temp" deleted successfully.

Error: registry key "HKLM\SYSTEM\CurrentControlSet\Services\SrvPjp" not found!
Deletion of registry key "HKLM\SYSTEM\CurrentControlSet\Services\SrvPjp" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: could not delete registry value "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList|ZyMrjJrXFlXVxrrlU"
Deletion of registry value "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList|ZyMrjJrXFlXVxrrlU" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Completed script processing.

*******************

Finished! Terminate.

[hijack88]

grazie grazie grazie Luke ho risolto rifacendo tutta la procedura daccapo! la pagina è sparita.
ora però il pc (dopo tutto quello che ho fatto con questi nuovi programmi) fa i capricci e prima di accendersi fa tre bip, uno lungo e due corti..